Microsoft has officially released the patch that fixes the WMF flaw. The patch can be download individually here, but it is advised to simply use Windows Update. Yesterday, Microsoft said it would not release it until next Tuesday, but two (1 | 2) third party fixes were already available. And to make matters worse, Microsoft accidentally leaked their own patch to the Net yesterday.
To read all comments associated with this story, please click here.
Member since:2005-06-29
There are more factors.
First, it they must decide on what is actually the best method for how to fix this flaw. All that must go through bureauocracy (it's a big company). Then, they actually do the fixing. Then comes the hard part. Testing.
They must make sure that their new patch breaks absolutely NOTHING. Imagine the damage if suddenly nobody could use Office anymore because the patch somehow affects Office? Or any of the other gazillion applications companies and individuals depend on each day? Do you really think they can test that in a few hours?
Look, I'm not saying that it can't be faster-- all I'm saying is that MS has to take a lot more possible user scenarios into account because they supply 95% of the computing world, instead of just a few percentages (very simply put).
Member since:2005-06-29
They must make sure that their new patch breaks absolutely NOTHING. Imagine the damage if suddenly nobody could use Office anymore because the patch somehow affects Office? Or any of the other gazillion applications companies and individuals depend on each day? Do you really think they can test that in a few hours?
Would you rather Office and your other applications stopped working because of an early MS patch, or because your machines were compromised?
Convenience (like easy-to-guess passwords, not challenging the person walking in the door behind you, or relying on the hope that you won't be infected before a patch is issued so that your apps don't break) seems to be the greatest enemy to security measures.
Member since:2005-09-28
In you're idyllic situation, the patch would probably be exploited as fast as it was released. Allowing a day for testing would imply that the code was written perfect the first time and there were no errors, or bugs while the patch was being written. In the world of coding I live in, undertesting causes most of my problems.
A week is a quick turn around for a situation as critical as this in an environment as complex as Windows.
Member since:2005-06-29
"It takes probably an hour to write up a patch for this vuln."
Ok, I'm not fond of the long wait either, but consider this:
Microsoft has been around for a long time, their operating system too. It's fair to assume that they use code from at least as far back as the 90's, more likely some time in the late 80's for some parts of their software. That's code reuse for you, it's a good time saver and it makes sense to keep the code if it works rather than waste time replacing it (and if bugs are found later that doesn't mean all the code needs to be scrapped, just fixed). Now Microsoft has had employees come and go from the company since then, no doubt most of the ones working on the really old code aren't around any more, and if they are do you really think they'll remember something from five years ago, nevermind a decade or more ago? They would have a general idea based on what part of the OS is affected where the vulnerability is, but it would still take time to search through all that source code to find out where exactly they need to make their changes, and whether or not those changes would fix the problem entirely, or whether someone could find a way to get around those changes. So do you still think one hour is a good estimate? I'd figure they'd need a couple at least just to get the code fixed up, and then I'd give them a day or two to get it compiled and tested to make sure it's safe for the public before they release it. A week may be a bit much, but a a day or two isn't unreasonable when you have a company with very old code and only so many employees who can be dedicated to the task of fixing bugs and security holes.
Member since:2005-12-04
I don't know exactly how long the vuln has been "known", but lets say one week.
i've known about it since i was in high school, but it wasn't quite as serious back then because the windows picture and fax viewer didn't exist and everyone was still using netscape 4... of course no one expected anything bad to happen from opening an ms word document (which can contain embedded wmf images), so i was still able to play a few hilarious practical jokes on a couple of my friends...
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.
PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
"In NixOS, the entire operating system - the kernel, applications, system packages, configuration files, and so on - is built by the Nix package manager from a description in a purely functional build language. The fact that it's purely functional essentially means that building a new configuration cannot overwrite previous configurations. Most of the other features follow from this." Interesting approach. A Linux distribution, sure, but with some very refreshing ideas about system configuration.
Appfour added, among other features, C/C++ support to its new version of AIDE. From Android-IDE, "Now you can write parts of your app or your whole app in C/C++ on your device. AIDE supports the Standard Android NDK toolchain (GCC 4.6 + Bionic, STL, ...). No changes are necessary if you want to build an app developed on a PC with Eclipse. C/C++ development is fully integrated: Build errors appear in the error list and files can easily be navigated to with Go to file. The editor supports C/C++ syntax highlighting."
Ars nails it: "The answer is that Google did announce what amounts to a fairly substantial Android update yesterday. They simply did it without adding to the update fragmentation problems that continue to plague the platform. By focusing on these changes and not the apparently-waiting-in-the-wings update to the core software, Google is showing us one of the ways in which it's trying to fix the update problem."
"It is good for programmers to understand what goes on inside a processor. The CPU is at the heart of our career. What goes on inside the CPU? How long does it take for one instruction to run? What does it mean when a new CPU has a 12-stage pipeline, or 18-stage pipeline, or even a 'deep' 31-stage pipeline? Programs generally treat the CPU as a black box. Instructions go into the box in order, instructions come out of the box in order, and some processing magic happens inside. As a programmer, it is useful to learn what happens inside the box. This is especially true if you will be working on tasks like program optimization. If you don't know what is going on inside the CPU, how can you optimize for it? This article is about what goes on inside the x86 processor's deep pipeline."
"It was the only moment I heard regret slip into Otellini's voice during the several hours of conversations I had with him. 'The lesson I took away from that was, while we like to speak with data around here, so many times in my career I've ended up making decisions with my gut, and I should have followed my gut,' he said. 'My gut told me to say yes.'" The world would've been a much different place - Apple would have been less dependant on Samsung for its chips, which probably would've meant less money for Samsung to develop its Galaxy business.
Member since:
2005-10-18
That is so true, I plan on going around tomorrow to various people I meet during the course of my day and ask them: So what do you think about WMF?
). 2 days = 48 hours. There’s 120 hours left there….
See how many people will have a clue.....lol
and Thom:
I don't know exactly how long the vuln has been "known", but lets say one week.
7 * 24 = 168 hours
It takes probably an hour to write up a patch for this vuln. Please don't flame me for saying ONE hour. I'm sure it could be done in that time considering all the "unofficial" patches that have popped up and all those instructions to unregister a dll and stuff like that....doesn’t seem hard to me…. But let’s give MS the benefit of the doubt and say it takes longer.
bottom line is that the patch can be written in a day. Especially considering how critical it is and the "potential" for damage. next? TeStInG. How long can that possibly take? I would go as bold to say again a couple hours, possibly a whole day.
So we're looking at 2 days to write a patch, test it, and then distribute it. And do so on the first available moment (not next Tuesday!
This is all considering that A multi-billion (perhaps trillion) dollar company, with near endless resources and motivation, who LOVES their customers and wants only to do good is involved.
If you notice, the first ones above apply to MS, but they get bleaker and bleaker
To sum up, Thom: 1 week to write a patch for a vuln is ok. 1 week to write a CRITICAL patch that has near invincibility and affects nearly the entire world (sadly)? NOT OK.
--ZaNkY